What is a Standard?
The term “standard” can be answered in one of two ways, since there are two distinct meanings (one being correct and the other incorrect). Unfortunately, “standard” falls in the common word crimes scenario since it is often used improperly. Using proper definitions helps avoid confusing scenarios such as trying to describe a “football bat” which is not a thing.
Proper use of “standard” relates to formalized, measurable rules that provide granular requirements to implement policies. A standard ensure uniform compliance across systems and exceptions must be formally justified.
Improper use of “standard” relates to common cybersecurity frameworks (e.g., SCF, NIST CSF, ISO 27001, NIST 800-53, etc.). This use of the term is focused on a “security framework” which is a basic structure underlying a system, concept, or text.